Intrusion Detection System (IDS)
An Intrusion Detection System (IDS) is a security tool that monitors network or host activity for signs of malicious behavior or policy violations and generates alerts, without taking direct action to block the traffic.
Definition
An Intrusion Detection System (IDS) is a security tool that monitors network or host activity for signs of malicious behavior or policy violations and generates alerts, without taking direct action to block the traffic.
Overview
An IDS works by continuously analyzing network traffic or host-level activity and comparing it against known attack signatures, anomaly baselines, or both. Signature-based detection matches traffic against a database of known attack patterns, similar to how traditional antivirus matches malware signatures, while anomaly-based detection establishes a baseline of "normal" behavior and flags significant deviations, which can catch novel attacks that have no known signature. IDS tools are generally deployed in two forms: Network Intrusion Detection Systems (NIDS), which monitor traffic at strategic points on the network, often analyzing packet captures similar to what a tool like Wireshark would show, and Host Intrusion Detection Systems (HIDS), which run as an agent on individual servers or endpoints, watching for suspicious file changes, log entries, or process activity. Because an IDS is purely passive — it observes and alerts but does not intervene — it is closely related to but distinct from an Intrusion Prevention System (IPS), which takes the same detection logic and adds the ability to actively block detected threats in real time. IDS alerts commonly feed into a Security Information and Event Management (SIEM) platform, where they are correlated with other data sources as part of a broader detection strategy, and are a key input for Threat Hunting teams looking for signs of compromise that automated rules alone might miss. Because a passive IDS cannot stop an attack in progress, many organizations that once deployed standalone IDS have shifted toward IPS or combined IDS/IPS appliances, though pure IDS still has a role in environments where blocking legitimate traffic by mistake (a false positive) carries a high operational cost, and visibility without disruption is preferred.
Key Features
- Signature-based and anomaly-based detection of malicious activity
- Network-based (NIDS) and host-based (HIDS) deployment models
- Passive monitoring — generates alerts without blocking traffic
- Feeds detections into SIEM platforms for broader correlation
- Supports threat hunting by surfacing suspicious patterns for investigation
- Lower operational risk than IPS since it never blocks legitimate traffic